---
title: Allow, Warn, Block
description: The three decisions you can make about an AI tool, what each one does on the laptop, and how a tool moves between them.
---

Every AI tool starts **Ungoverned**: found, scored, but nobody has decided about it yet. It waits in the **Open** list on the Remediation page. When an Owner or Admin decides, the tool becomes **Governed**.

```mermaid
flowchart LR
  N[Scanner finds a tool] --> O[Open list]
  O -->|Allow| A[Allowed]
  O -->|Warn| W[Warned]
  O -->|Block| B[Blocked]
```

## The three decisions

| Decision | What happens on the laptop | When to use it |
| --- | --- | --- |
| **Allow** | Nothing changes. The tool is recorded as approved | Tools you are fine with |
| **Warn** | The person sees a system notification that the tool is not approved, and sees it again each time the tool opens. The tool stays installed | Tools under review, or tolerated with a reminder |
| **Block** | The scanner backs the tool up, then removes it. If it cannot be removed, the scanner closes it every time it opens | Tools that are not permitted |

## How a decision reaches laptops

```mermaid
sequenceDiagram
  participant Admin
  participant Console
  participant Laptop
  Admin->>Console: Block "Tool X"
  Console-->>Laptop: Notified within seconds (if online)
  Laptop->>Laptop: Back up, then remove Tool X
  Laptop-->>Console: Report: removed or failed
  Console-->>Admin: Audit log entry
```

Laptops that are online act within seconds. Laptops that are offline act at their next scan. Every laptop reports back, and failures show in the [Audit log](/surface/admin/audit-log).

:::warning
Block removes software from people's laptops. Read the confirmation window: it names the tool and how many laptops are affected. For a new tool, try Warn on a small group first.
:::

## Scope

A decision is company-wide by default. You can also make an exception for one laptop, for example a security researcher who needs a blocked tool. See [Remediate a tool](/surface/governance/remediate).

Decisions never quietly disappear. A tool stays in Allowed, Warned, or Blocked even if no laptop has reported it recently.

## Next steps

<CardGroup cols={2}>
  <Card title="Remediate a tool" href="/surface/governance/remediate" icon="shield-check">
    Step by step: one tool, many tools, or one laptop.
  </Card>
  <Card title="How risk is calculated" href="/surface/risk/scoring" icon="gauge">
    Decide with the score in mind.
  </Card>
</CardGroup>